h~tdZddlZddlmZddlmZmZddlmZddl m Z m Z m Z m Z mZddlmZmZmZmZmZmZddlmZdd lmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$dd l%m&Z& ddl'Z'n #e($rYnwxYwe$rdd l)m*Z*ed d e&fde&fgZ+e"de&e+Z,Gddee,e Z-Gdde-e&e e&eZ.e#ee&e&e e&e-e&fZ/Gdde-e+e e+eZ0dS)zH PacketList: holds several packets and allows to do operations on them. N) defaultdict)Sequence NamedTuple)conf) BasePacketBasePacketListPacketList_metaclassSetGen_CanvasDumpExtended)do_graphhexdump make_tablemake_lined_tablemake_tex_table issubtypereduce) AnyCallable DefaultDictDictGenericIteratorListOptionalTupleTypeTypeVarUnion TYPE_CHECKING)Packet)Line2D QueryAnswerqueryanswer_Innerc@eZdZgdZ d*dZdZdZdZdZd Z d Z d Z d Z d Z dZedddZdZ d+dZ d+dZdZdZdZdZdZ d,dZ d-dZ d,dZdZd.dZd.d Zd.d!Zd.d"Z d.d#Z! d/d$Z"d0d&Z# d.d'Z$d(Z% d1d)Z&dS)2 _PacketList)statsreslistnameN PacketListc| tj}||_|g|_n)t |t r |j|_n||_||_dS)zcreate a packet list from a list of packets res: the list of packets stats: a list of classes that will appear in the stats (defaults to [TCP,UDP,ICMP])N)rstats_classic_protocolsr)r* isinstancer(r+)selfr*namer)s O/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/plist.py__init__z_PacketList.__init__EsU =0E ;DHH [ ) ) wDHHDH c*t|jSN)lenr*r0s r2__len__z_PacketList.__len__Ys48}}r4c|Sr6r0elts r2_elt2pktz_PacketList._elt2pkt]s r4c*|Sr6summaryr<s r2_elt2sumz_PacketList._elt2sumas{{}}r4c,||Sr6)rBr<s r2 _elt2showz_PacketList._elt2showes}}S!!!r4c d|jD}d}|jD]L}d}|D]>}|||r||xxdz cc<d}n?|s|dz }Md}tj}|jD]R}|d||j|d| ||z }S|d|d|d| |z }|d| |j |d||d S) Nci|]}|dS)rr;.0xs r2 z(_PacketList.__repr__..ks***!A***r4r :Other<>) r)r*r>haslayerr color_themepacketlist_proto_namepunctpacketlist_valuepacketlist_namer+)r0r)otherrfpscts r2__repr__z_PacketList.__repr__is**tz***  AA  ==##,,Q//!HHHMHHHAE      = =A Ab11!'::: hhsmmm 11%(;;;= =AA "--g666((3-----e4446 6 "xx}}}!11$-@@@!xx}}} q!xx}}} . .r4c0|j|j|jd}|S)z Creates a basic representation of the instance, used in conjunction with __setstate__() e.g. by pickle :returns: dict representing this instance r*r)r+rar0states r2 __getstate__z_PacketList.__getstate__s&8Z     r4cT|d|_|d|_|d|_dS)z Sets instance attributes to values given by state, used in conjunction with __getstate__() e.g. by pickle :param state: dict representing this instance r*r)r+Nrarbs r2 __setstate__z_PacketList.__setstate__s*<7^ j) r4c4|jSr6)r*__iter__r8s r2rhz_PacketList.__iter__sx  """r4c,t|j|Sr6)getattrr*)r0attrs r2 __getattr__z_PacketList.__getattr__stx&&&r4clttr8fdjDjdjSt tr7jdjzSjS)NcBg|]}|v|Sr;)r>)rHrIitemr0s r2 z+_PacketList.__getitem__..s0"S"S"S$$--PQBRBR:R:R1:R:R:Rr4z from r1zmod %s) rr __class__r*__name__r+r/slice __getitem__)r0ros``r2ruz_PacketList.__getitem__s T: & & V>>"S"S"S"S"Sdh"S"S"S7;}}}dmm'T"VV V dE " " A>>$("6"6t"<"<'/$-'?"AA Ax##D)))r4_T SndRcvListch||j|jz|jd|jS)N+rqrrr*r+)r0rYs r2__add__z_PacketList.__add__s@~~ Huy     r4c|jD]A}|||s |#t||/t||BdS)aprints a summary of each packet :param prn: function to apply to each packet instead of lambda x:x.summary() :param lfilter: truth function to apply to each packet to decide whether it will be displayed N)r*printrB)r0prnlfilterrZs r2rAz_PacketList.summarysk  A"w{{dmmA&&''''cc1g  r4ct|jD]t\}}|||s ttj|dd|#t||bt||udS)a)prints a summary of each packet with the packet's number :param prn: function to apply to each packet instead of lambda x:x.summary() :param lfilter: truth function to apply to each packet to decide whether it will be displayed N%04ifmtrM)end) enumerater*r}rrSidrB)r0r~rir*s r2nsummaryz_PacketList.nsummarys )) ! !FAs"w} $"%%aV%44# > > > >{dmmC(())))cc3i     ! !r4c|j|i|S)zBBest way to display the packet list. Defaults to nsummary() method)rr0argskargss r2showz_PacketList.showst}d,e,,,r4cd|fd|jDd|jzS)zReturns a packet list filtered by a truth function. This truth function has to take a packet as the only argument and return a boolean value. cg|] }|| Sr;r;)rHrIfuncs r2rpz&_PacketList.filter..s$???QddAh?q???r4z filtered %srqrz)r0rs `r2filterz_PacketList.filtersF ~~????$(???#04=#@BB Br4c,t|jg|Ri|S)zPrints a table using a function that returns for each packet its head column value, head row value and displayed value # noqa: E501 ex: p.make_table(lambda x:(x[IP].dst, x[TCP].dport, x[TCP].sprintf("%flags%")) )rr*rs r2rz_PacketList.make_tables$$(3T333U333r4c,t|jg|Ri|S)z0Same as make_table, but print a table with lines)rr*rs r2rz_PacketList.make_lined_tables$ 949995999r4c,t|jg|Ri|S)z7Same as make_table, but print a table with LaTeX syntax)rr*rs r2rz_PacketList.make_tex_tables$dh7777777r4Fc ddlm}m}m}fd|jD}nfd|jD}|ikr|}|r|jt |i|} n|j|fi|} |s|| S)zApplies a function to each packet to get a value that will be plotted with matplotlib. A list of matplotlib.lines.Line2D is returned. lfilter: a truth function that decides whether a packet must be plotted rpltMATPLOTLIB_INLINEDMATPLOTLIB_DEFAULT_PLOT_KARGSNcg|]}|Sr;r;rHer[s r2rpz$_PacketList.plot.. s000!1000r4c$g|] }|| Sr;r;rHrr[rs r2rpz$_PacketList.plot.."s*???!77A;?1???r4)scapy.libs.matplotrrrr*plotzipr) r0r[rplot_xyrrrrlst_pktsliness `` r2rz_PacketList.plot s           ?0000tx000HH?????tx???H B;;1E  0CHc8n666EECHX////E"  HHJJJ r4rKc Dddlm}m}m}2fdt t j|z D}n2fdt t j|z D}|ikr|}|j|fi|} |s|| S)zdiffplot(f, delay=1, lfilter=None) Applies a function to couples (l[i],l[i+delay]) A list of matplotlib.lines.Line2D is returned. rrNcZg|]'}j|j|dz(SrKr*)rHrr[r0s r2rpz(_PacketList.diffplot..HsE???$(1+txA77???r4cg|]=}j|j|j|dz>Srr)rHrr[rr0s r2rpz(_PacketList.diffplot..KsZ111"748A;//1$(1+txA77111r4) rrrrranger7r*rr) r0r[delayrrrrrrrs `` ` r2diffplotz_PacketList.diffplot2s           ??????!&s48}}u'z(_PacketList.multiplot..ps)00!1000000r4c3,K|]}||VdSr6r;rs r2rz(_PacketList.multiplot..rs4??!77A;?1??????r4c vg|]5\}}jtt|it|6S)label)rlistrdictrHkplrrs r2rpz)_PacketList.multiplot..~sU---BSXtCH~~Fe11E1E1EFF---r4c Pg|]"\}}j|fit|#Sr)rrrs r2rpz)_PacketList.multiplot..sN---BSXb99Da$8$8$899---r4z center right)g?g?)locbbox_to_anchor) rrrrr* setdefaultappenditemslegendr) r0r[rrrrrrdrvrrs `` ` @r2 multiplotz_PacketList.multiplotZsn           ?0000tx000HH?????tx???H  * *DAq LLB   & &q ) ) ) ) 21E  ------"#''))---EE-----"#''))---E ~j AAA"  HHJJJ r4cT|D]$}t||%dS)z5Prints an hexadecimal dump of each packet in the listN)r r>)r0r\s r2 rawhexdumpz_PacketList.rawhexdumps: & &A DMM!$$ % % % % & &r4c t|jD]\}}||}| ||s(ttj|dd|dd||| tj r1t| tj j dS)zSame as nsummary(), except that if a packet has a Raw layer, it will be hexdumped # noqa: E501 lfilter: a truth function that decides whether a packet must be displayedNrrrM%.time%)rr*r>r}rrSrsprintfrBrR raw_layerr getlayerloadr0rrr*r\s r2hexrawz_PacketList.hexraws )) 9 9FAs c""A"771::"  0 3 3A6 3 B B B B ! ) 4 4 4 4 $ c 2 2 24 5 5 5zz$.)) 9 4>227888 9 9r4c Vt|jD]\}}||}| ||s(ttj|dd|dd||t|dS)zSame as nsummary(), except that packets are also hexdumped lfilter: a truth function that decides whether a packet must be displayedNrrrMr) rr*r>r}rrSrrrBr rs r2r z_PacketList.hexdumps ))  FAs c""A"771::"  0 3 3A6 3 B B B B ! ) 4 4 4 4 $ c 2 2 24 5 5 5 AJJJJ  r4c t|jD]\}}||}|tjr| ||rt tj|dd| dd| |t| tjj dS)z#Same as hexraw(), for Padding layerNrrrMr)rr*r>rRr padding_layerr}rSrrrBr rrrs r2paddingz_PacketList.paddings ))  FAs c""Azz$,-- ?ggajj?(8(;(;A6(;(J(J(J(J() )(<(<(<(<(, c(:(:(:<=== 4#566;  r4c `t|jD]\}}||}|tjr|tjj}||ddt|zkr}| ||rttj |dd| dd| |t|tjjdS)z+Same as padding() but only non null paddingNrKrrrMr)rr*r>rRrrrrr7r}rSrrrBr )r0rrr*r\pads r2 nzpaddingz_PacketList.nzpaddings" ))  FAs c""Azz$,-- jj!3449#bqb'CHH,,,?ggajj?(8(;(;A6(;(J(J(J(J() )(<(<(<(<(, c(:(:(:<=== 4#566;  r4c Z|d}|}i}|jD]}||} ||}n#t$rY0wxYwt|dkrD||ddt |d||ddz||<d}|D]K\\} } } |d| d | d t| t rd d | Dn| d z }L|dz }t|fi|S)amGraphes a conversations between sources and destinations and display it (using graphviz and imagemagick) :param getsrcdst: a function that takes an element of the list and returns the source, the destination and optionally a label. By default, returns the IP source and destination from IP and ARP layers :param type: output type (svg, ps, gif, jpg, etc.), passed to dot's "-T" option :param target: filename or redirect. Defaults pipe to Imagemagick's display program :param prog: which graphviz program to use Ncd|vr|dj|djfSd|vr|dj|djfSd|vr|dj|djfSt )zExtract src and dst addressesIPIPv6ARP)srcdstpsrcpdst TypeError)pkts r2 _getsrcdstz-_PacketList.conversations.._getsrcdstsn3;;IM3t9=99S==KOS[_==C<<JOSZ_==kk!r4rrKzdigraph "conv" { z "z" -> "z " [label="z, c34K|]}t|VdSr6)strrGs r2rz,_PacketList.conversations..s(221A222222r4z"] z} ) r*r> Exceptionr7rsetaddgetrr/joinr ) r0 getsrcdstrrconvr=r\cgrr]rls r2 conversationsz_PacketList.conversationss{$   " " "#I8 - -C c""A IaLL      1vv{{"1"suu--11!A$7777((1a..1,Q !  IFQA B111jC6H6HOdii22222222aOO BB e $$e$$$s 5 AAc |d}|d}|d}i}i}i}|jD]} ||||||} } } | |vr1|| \} } | dz } | | vr| | | | f|| <nd| gf|| <| |vr1|| \} } | dz } | | vr| | | | f|| <nd| gf|| <|| ddz|| <#t$rYwxYwd}|d|D\}}|d |D\}}||\}}d }|d z }|D]N} || \} }dt | |z ||z z z} |d t | t | | | fzz }O|d z }|D]N} || \} }dt | |z ||z z z} |dt | t | | | fzz }O|D]K} || } dt | |z ||z z z} |dt | t | | | fzz }L|dz }|D]8} || \} }|D](} |dt | dt | dz })9|D]8} || \} }|D](} |dt | dt | dz })9|dz }t|fi|S)zExperimental clone attempt of http://sourceforge.net/projects/afterglow each datum is reduced as src -> event -> dst and the data are graphed. by default we have IP.src -> IP.dport -> IP.dstNc(|ddjSNrr)rrIs r2z'_PacketList.afterglow.. QqT$Z^r4c(|ddjSr)dportrs r2rz'_PacketList.afterglow..sqtDz/r4c(|ddjSr)rrs r2rz'_PacketList.afterglow..rr4rKrcftdd|D\}}||krd}|dkrd}||fS)Ncrt|d|dt|d|dfS)NrrK)minmax)abs r2rz7_PacketList.afterglow..minmax..-s+AaD!A$QqT1Q4'Ir4c3K|]}||fV dSr6r;)rHrs r2rz8_PacketList.afterglow..minmax...s&--aAq6------r4rrKr)rImMs r2minmaxz%_PacketList.afterglow..minmax+sQII--1---//DAqAvvAvva4Kr4c3 K|] \}}|V dSr6r;rHrI_s r2rz(_PacketList.afterglow..5&66$!QA666666r4c3 K|] \}}|V dSr6r;rs r2rz(_PacketList.afterglow..6rr4z'digraph "afterglow" { edge [len=2.5]; z # src nodes zl"src.%s" [label = "%s", shape=box, fillcolor="#FF0000", style=filled, fixedsize=1, height=%.2f,width=%.2f]; z# event nodes zp"evt.%s" [label = "%s", shape=circle, fillcolor="#00FFFF", style=filled, fixedsize=1, height=%.2f, width=%.2f]; zr"dst.%s" [label = "%s", shape=triangle, fillcolor="#0000ff", style=filled, fixedsize=1, height=%.2f, width=%.2f]; z### z "src.z " -> "evt.z"; z "evt.z " -> "dst.})r*rrrvaluesfloatreprr )r0reventrrsleldlrr]rrnlstrminsmaxsminemaxemindmaxdrrlst1lst2s r2 afterglowz_PacketList.afterglows ;++C =//E ;++C     A #a&&%%((CCFFa177UFAsFA|| 1 HBqEEHBqE77UFAsFA|| 1 HBqEEHBqEq! q(1       V66"))++66666 dV66"))++66666 dVBIIKK(( d 9 o ] ]Aa5DAqE!d(OOtd{33A BFJKLFMFMOSTUOVOVXY[\E]] ]BB  a aAa5DAqE!d(OOtd{33A FJNOPJQJQSWXYSZSZ\]_`Iaa aBB c cA1AE!d(OOtd{33A HLPQRLSLSUYZ[U\U\^_abKcc cBB g  F FAeGAt F FDGGGGT!WWWWEE F F FAeGAt F FDGGGGT!WWWWEE F c $$e$$$sB7C C%$C%rc tj}t|j}t |jD]\}}||||}|}|| | dzd||fztjj j gtjdkrtjdd|tj|tjjjdtjjzd |S)N) layer_shiftrebuildrKz+\font\cmssfont=cmss12\cmssfont{Frame %i/%i}r.) paperformatmargin fittosize)pyxdocumentr7r*rr> canvas_dumpbboxtextlefttopsizeLARGErverboswriterpagerA4unitt_cm) r0rrrlen_resrr*rcbbs r2r#z_PacketList.canvas_dumpWsC L ! ! # #dh--)) 5 5FAs c""..;7>/@@A&&((C FF388::swwyy1}.\`acj_k.knqnvn{oBnC D D DyA~~D!!! HHS\&&qcl6N6Q./#(-.?12'44 5 5 5 5r4c|d}|}t|j}|jD];}|||}||| {}:%r,TCP.dport%UDPz'UDP {}:%r,UDP.sport% > {}:%r,UDP.dport%ICMPz?ICMP {} > {} type=%r,ICMP.type% code=%r,ICMP.code% id=%ICMP.id%ICMPv6z8ICMPv6 {} > {} type=%r,ICMPv6.type% code=%r,ICMPv6.code%zIPv6 {} > {} nh=%IPv6.nh%zIP {} > {} proto=%IP.proto%rzARP %ARP.psrc% > %ARP.pdst%zEthernet type=%04xr,Ether.type%rO)rformat)r\ ip_src_fmt ip_dst_fmtaddr_fmtrs r2_session_extractorz0_PacketList.sessions.._session_extractormsa<<qyyFaKK%E %E $. #; A::"KCC"aZZ"KCC#q[[#???! yy)FGGG yy)JKKKwr4)rrrr*r>rr)r0session_extractorr>sessionsr\sesss r2r@z_PacketList.sessionsgs  $   8!3 t~.. % %A$$ a  D TN ! !! $ $ $ $H~~r4cb|dd}td|jz}t|dts|f}|jD]}||}d}|D]}|d} |d} |d} | jD]} | |vrt|dks$||  | j | krJ|s,| }|r| d }t|| | j | |||S) aN lst.replace(,[,]) lst.replace( (fld,[ov],nv),(fld,[ov,]nv),...) if ov is None, all values are replaced ex: lst.replace( IP.src, "192.168.1.1", "10.0.0.1" ) lst.replace( IP.ttl, 64 ) lst.replace( (IP.ttl, 64), (TCP.sport, 666, 777), ) delete_checksumsFz Replaced %srqrrKrT)rr,r+r/tupler*r>ownersr7 getfieldvalr1copyrCsetattrr) r0rrrCrI_pr\copiedschemefldoldnewos r2replacez_PacketList.replacesQ!99%7?? MDM9 : : :$q'5)) 7D(  B b!!AF 9 9QiQiRj99AAvvv;;!++qt/?/?/I/IS/P/P#).$%FFHH#3!9$%$6$6$8$8$8)-#AaD#(C8889 HHQKKKKr4c| dj|j}|j}i|||d<||d<t dfdjDD||S)aReturns the packet list from a given layer. See ``Packet.getlayer`` for more info. :param cls: search for a layer that is an instance of ``cls`` :type cls: Type[scapy.packet.Packet] :param nb: return the nb^th layer that is an instance of ``cls`` :type nb: Optional[int] :param flt: filter parameters for ``Packet.getlayer`` :type flt: Optional[Dict[str, Any]] :param name: optional name for the new PacketList :type name: Optional[str] :param stats: optional list of protocols to give stats on; if not specified, inherits from this PacketList. :type stats: Optional[List[Type[scapy.packet.Packet]]] :rtype: scapy.plist.PacketList Nz {} layer {}clsnbcg|]}||Sr6r;)rHpcs r2rpz(_PacketList.getlayer..s%!!! r4c3XK|]$}|jdiV%dS)Nr;)r>r)rHr\ getlayer_argr0s r2rz'_PacketList.getlayer..sT>?) a  )99L99r4)r:r+rsr)updater,r*)r0rSrTfltr1r)rXs` @r2rz_PacketList.getlayers8 < '' s|DDD =JE ?    $ $ $! U >!#L !!CG8!!! %    r4)Nr,N)NN)NF)rKNr6)NNN)rrK)NNNN)'rs __module__ __qualname__ __slots__r3r9r>rBrDr_rdrfrhrlrurrvr{rArrrrrrrrrrrr rrrrr#r@rQrr;r4r2r(r(Bs,,,I"("""...8    * * *###'''*** |\ 2 2B    ,!!!!,--- BBB444 ::: 888&&&&T&&&&T////b&&& 9 9 9 9        $!%4%4%4%4%nT%T%T%T%l$#))))V   F . . . . . . r4r() metaclassceZdZddZdS)r,FNc|jdd}g}d}||dkrt|}|t|kr||}|}|t||zt|dz kr|dz }||}||rL|t |||rd||_d||_||=||=|dz}n'|t||zt|dz k|dz }|t|k|r d|D}t|t|fS)ag Matches packets in the list :param multi: True if a packet can have multiple answers :param lookahead: Maximum number of packets between packet and answer. If 0 or None, full remaining list is scanned for answers :return: ( (matched couples), (unmatched packets) ) NrrKrc2g|]}t|d|S) _answered)hasattrrGs r2rpz!PacketList.sr.. s'GGGAwq+/F/FGaGGGr4) r*r7ranswersrr#rbrwr,) r0multi lookaheadremainsrrr]jrZs r2rhz PacketList.srsk!!!     QF I#f++ooq AAc)a-Vq9999Q1I99Q<< IIk!Q//000!./q +./q + q q FAc)a-Vq9999 FA!#f++oo"  HGGGGGF"~~z&1111r4)FN)rsr[r\rhr;r4r2r,r,s(#2#2#2#2#2#2r4r,c6eZdZgZ dfd ZdZdZxZS)rwNResultsc\tt||||dSr6)superrwr3)r0r*r1r)rrs r2r3zSndRcvList.__init__s- j$((dE:::::r4c|dS)NrKr;r<s r2r>zSndRcvList._elt2pkt#s 1v r4cp|dd|dS)Nrz ==> rKr@r<s r2rBzSndRcvList._elt2sum's2!!fnn....A0@0@0@AAr4)NrkN)rsr[r\r]r3r>rB __classcell__)rrs@r2rwrwstI;;;;;;BBBBBBBr4rw)1__doc__r+ collectionsrtypingrr scapy.configrscapy.base_classesrrr r r scapy.utilsr r rrrr functoolsrrrrrrrrrrrrrr scapy.packetr!r! ImportErrorrr"r#r&r(r,_PacketIterablerwr;r4r2r{s%   ######''''''''  JJJJ   D *))))))j v6*+ 6; / /`  `  `  `  `  '&/-A`  `  `  `  F&2&2&2&2&2V$'$&2&2&2R V  6NBBBBB[) ,$BBBBBs$A))A10A1